Minas de Estaño de España, S.L.U. (hereinafter, “MESPA” or the “Company”) informs you that, as a general rule, it does not collect personal data through the website it owns, https://mespa.es (hereinafter, the “Website” or, where the context so requires, the “page” or the “site”). However, in the course of its business activities, it may need to carry out certain personal data processing. In such cases, processing will be carried out in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and with Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
PRIVACY POLICY SUMMARY
| Topic | Information |
|---|---|
| Controller | Minas de Estaño de España, S.L.U. (MESPA) |
| Data processed | Data provided in enquiries and communications, in commercial, contractual, or professional relationships, and technical website browsing data. |
| Purposes | Responding to enquiries, managing commercial and professional relationships, complying with legal obligations, and ensuring the security and operation of the Website. |
| Legal basis | Contract or pre-contractual measures, legal obligation, legitimate interest, and consent where applicable. |
| Retention | For as long as necessary for the purpose and, thereafter, for the applicable statutory periods. |
| Recipients | Authorities where there is a legal obligation, and advisers and providers who need access to the data to provide services to MESPA, with the prior consent of the data subject. |
| Rights | Access, rectification, erasure, objection, restriction, portability, and withdrawal of consent where applicable. |
DATA CONTROLLER
MESPA is the controller of any personal data that may be collected through the Website, as well as of any data provided in the context of relationships maintained by third parties with the Company.
The controller’s identification and contact details are:
- Company name: Minas de Estaño de España, S.L.U.
- Tax ID (NIF): B-91722280.
- Registered office: Polígono Industrial Fuente Las Dos, nave 1, Fuente Obejuna (Postcode 14290, Córdoba).
- Email: info@mespa.es.
- Website: https://mespa.es.
This Privacy Policy provides information on the purposes of processing, the legal bases for it, the recipients of the data, retention periods, and the rights of data subjects, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), and other applicable legislation.
WHAT PERSONAL DATA DO WE COLLECT AND HOW DO WE OBTAIN IT?
MESPA may process personal data when a data subject contacts the Company, requests information, maintains a commercial, contractual, or professional relationship with it, acts on behalf of a person or entity, or browses the Website.
Depending on the relationship and the relevant purpose, the following categories of data may be processed:
- Identification and contact data, such as first name and surname, email address, telephone number, and any other data provided by the data subject.
- Data contained in enquiries, requests for information, and other communications addressed to MESPA.
- Professional, commercial, and contractual data necessary to manage relationships with customers, suppliers, partners, and other professional contacts.
- Data relating to representatives, partners, shareholders, investors, or other interested parties, where necessary to manage the relevant relationship.
- Technical data generated by browsing the Website, such as device, browser, connection, and browsing activity information, as described in the Cookie Policy.
Data may be obtained directly from the data subject, from the person or entity they represent, from advisers or third parties lawfully involved in the relationship with MESPA, and from publicly accessible sources where their use is lawful and relevant.
Data provided must be accurate and up to date. Anyone who provides personal data of third parties must be entitled to do so and, where applicable, comply with the corresponding information obligations.
If the Website includes forms or other specific data collection channels, specific information about the purpose and, where applicable, whether fields are mandatory or optional will be provided in the form or channel itself.
WEBSITE VISITORS AND COOKIES
When the Website is visited, certain technical data relating to the device, browser, connection, and browsing may be processed, to the extent that such data are generated or necessary for the operation, security, and management of the page.
The Website may use cookies and similar technologies. Information on the cookies used, their purposes, their classification, and how to manage preferences is available in the Cookie Policy published on the Website. Where legally required, non-essential cookies will only be used after obtaining the relevant consent. Users may view and change their preferences through the cookie management tool available on the Website.
FOR WHAT PURPOSE DO WE PROCESS PERSONAL DATA?
Overall, the purpose of processing is essentially that inherent to making the Website publicly available and to the interactions between MESPA and third parties that may take place through the site. In this regard, the following cases can be distinguished:
| Source or context | Purpose of processing |
|---|---|
| Enquiries and communications | Responding to enquiries, requests for information, and communications received, and carrying out any necessary follow-up. |
| Commercial, contractual, and professional relationships | Managing relationships with customers, suppliers, partners, and other contacts; fulfilling commitments undertaken; and carrying out the related administrative, organisational, and invoicing tasks. |
| Legal obligations | Complying with the tax, accounting, commercial, and administrative obligations applicable to MESPA, and responding to requests from competent authorities. |
| Use and security of the Website | Enabling the Website to operate, detecting incidents, preventing misuse, and protecting systems and information. |
| Cookies and preferences | Recording and applying preferences regarding the use of cookies and similar technologies, in accordance with the Cookie Policy. |
Where it becomes necessary to process data for a purpose other than those indicated, MESPA will provide the relevant information before such processing takes place, where required by law.
WHAT IS THE LEGAL BASIS FOR PROCESSING?
The processing of your data will be based on one of the conditions set out in applicable legislation and, where appropriate, you will be informed of the relevant legal basis in the documents and/or forms you sign and/or complete for that purpose.
Where the processing of your data is based on your consent, such consent must be given expressly and may be withdrawn at any time. Withdrawal of consent will not affect processing of your data on other legal bases, nor will it affect the performance of any contract entered into by the parties.
On this basis, the following can be distinguished:
| Processing | Legal basis |
|---|---|
| Handling enquiries and communications | Taking pre-contractual steps at the data subject’s request where applicable, MESPA’s legitimate interest in managing professional communications, or consent where necessary. |
| Commercial, contractual, and professional relationships | Performance of a contract or pre-contractual measures, compliance with legal obligations, and MESPA’s legitimate interest where applicable. |
| Compliance with legal obligations | Compliance with the legal obligations to which MESPA is subject. |
| Website security and operation | MESPA’s legitimate interest in protecting its systems and ensuring the operation of the Website, or compliance with a legal obligation where applicable. |
| Cookies | User consent where required, and compliance with applicable legal obligations. |
IS IT MANDATORY TO PROVIDE DATA?
Data requested as necessary to respond to an enquiry, enter into or manage a contractual relationship, or comply with a legal obligation must be provided where essential for those purposes. Failure to provide such data may prevent the request from being handled or the relationship from being properly managed. Where the provision of data is based on consent, it is voluntary.
CAN CONSENT BE WITHDRAWN?
Where processing is based on consent, the data subject may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, nor any processing that may be based on other legal grounds.
HOW LONG DO WE KEEP DATA?
Personal data will be kept for as long as strictly necessary to fulfil the purpose for which they were collected and, thereafter, for the periods required by applicable law or for as long as liabilities may arise from the processing or the relationship.
Accordingly, as a general rule, where any contractual or legal relationship is established, data will be kept for as long as that relationship remains in force and will then be retained for the statutory limitation periods, in accordance with applicable tax, civil, and commercial law and the sector-specific regulations applicable to MESPA.
On this basis, the following cases can be distinguished:
- Enquiries and communications: for as long as necessary to respond to them and carry out the relevant follow-up, without prejudice to subsequent retention where necessary to address potential liabilities.
- Contractual, commercial, accounting, or tax relationships: for the duration of the relationship and for the applicable statutory retention and limitation periods.
- Data processed on the basis of consent: for as long as the purpose for which they were collected remains and, where applicable, consent is maintained, without prejudice to legal retention obligations.
- Technical data and cookie preferences: for the periods necessary for their respective purposes, as set out in the Cookie Policy.
When data are no longer necessary, they will be erased or, where legally required, blocked for the relevant periods.
TO WHOM IS PERSONAL DATA DISCLOSED?
MESPA will not sell personal data to third parties. However, it may disclose data or allow access to it where there is a legal basis for doing so and it is necessary for the purposes described in this Policy, to:
- Public administrations, authorities, and courts, where there is a legal obligation or a valid request requiring it.
- External advisers and professionals, including legal, tax, and accounting advisers, where their involvement is necessary.
- Service providers necessary for MESPA’s activities, including providers of web hosting, IT maintenance, email, storage, or systems management services.
- Other persons or entities, where disclosure is necessary to manage a contractual relationship, has been validly requested or authorised by the data subject, or is permitted by another legal basis.
Where providers process personal data on behalf of MESPA, they will act as data processors where applicable and will be subject to the contractual and confidentiality obligations required by applicable law.
INTERNATIONAL DATA TRANSFERS
Where personal data are transferred outside the European Economic Area, MESPA will ensure that the requirements set out in Chapter V of the GDPR are met and that a valid legal mechanism is in place for such transfers. Depending on the case, safeguards may include an adequacy decision by the European Commission, standard contractual clauses, or other legally recognised mechanisms.
HOW DO WE STORE AND PROTECT INFORMATION?
Data may be stored on MESPA’s own systems or on the systems of providers delivering technology services on behalf of the Company.
MESPA adopts appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, or unauthorised disclosure or access, taking into account the nature of the data, the risks involved in the processing, and the obligations established by applicable law.
Where external providers are involved, MESPA will seek to ensure that they provide the required guarantees and will enter into the necessary agreements where applicable.
WHAT RIGHTS DO DATA SUBJECTS HAVE?
Data subjects may exercise the following rights regarding their personal data, under the terms provided by applicable law:
Right of access: to find out whether MESPA is processing their personal data and to obtain access to it, as well as information about any processing being carried out.
Right to rectification: to request the correction, updating, or modification of inaccurate or incomplete data.
Right to erasure: to request the deletion of data, unless there is a legal obligation to retain it and/or other legitimate grounds prevail for MESPA to continue processing it under current legislation.
Right to restriction of processing: to request that processing be restricted or suspended so that MESPA does not process the data in the future, retaining it solely for the establishment, exercise, or defence of legal claims.
Right to data portability: to receive the data provided in a structured, commonly used, and machine-readable format, and to transmit it to another controller where the legal requirements are met.
Right to object: to object to the processing of data in certain circumstances and on grounds relating to their particular situation; where this right is exercised, MESPA will stop processing the data, except for legal reasons or where necessary for the establishment, exercise, or defence of potential legal claims.
Right to withdraw consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Right not to be subject to automated individual decision-making: to exercise the rights recognised by law in the cases where this applies.
To exercise these rights, data subjects may write to info@mespa.es, stating the right they wish to exercise and providing the information necessary to process their request. If there is reasonable doubt as to their identity, MESPA may request additional information to verify it.
Exercising these rights is free of charge, unless requests are manifestly unfounded or excessive, in which case the measures provided for by law may apply. MESPA will respond to requests within the legally established time limits.
COMPLAINTS TO THE SUPERVISORY AUTHORITY
If a data subject considers that the processing of their personal data does not comply with the law, they may contact MESPA to submit their enquiry or complaint.
They also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), particularly where they consider that they have not obtained satisfaction in exercising their rights. Further information is available at https://www.aepd.es/.
LINKS TO THIRD-PARTY WEBSITES
The Website may include links to third-party websites or services. If you access them, any processing of personal data they carry out will be governed by their own privacy and cookie policies.
MESPA does not control the data protection policies or practices of such third parties. We recommend reviewing their terms before providing them with any personal information.
CHANGES TO THIS PRIVACY POLICY
MESPA may update this Privacy Policy where necessary to adapt it to regulatory changes, changes in data processing, or changes in the operation of the Website.
The updated version will be available on the Website and will indicate, where applicable, the date of its last update. Where a change affects the information that must be provided to data subjects, the information measures required under applicable law will be adopted.
